The University of Arizona’s cyber operations program has joined a small group of institutions designated as a Center of Academic Excellence in Cyber Operations by the National Security Agency.
Only 20 programs have this designation, and the UA’s program, based at the UA South campus in Sierra Vista, is a bachelor’s of applied science program and a transfer degree, meaning students start at a community college and transfer to finish their last two years with UA, according to Melody Buckner, interim dean at UA South.
“Our program has always been accredited to be a full degree at the University of Arizona,” Buckner said. “Now, it’s going to have this behind it, so it will attract more attention. We will be getting money from the NSA, students will see that this has been elevated, because we met their criteria.”
RELATED: Breakthrough peptides developed for skin cancer prevention
Buckner said the program, designed by Program Director of Cyber Operations Jason Denno, was created with the NSA CAE-CO designation in mind, which is how it achieved the CAE-CO status after only about 18 months.
“When [Jason] created the program, he created it from the ground up, knowing that he was going to one day apply for the NSA Center of Excellence designation,” Buckner said. “So it’s been designed to always be that, but it took us two years to get that, which is really pretty fast.”
The program has two tracks right now, engineering and forensics. The engineering track is the track that received the designation, according to Buckner.
“That’s the harder track, so the students that are going into that track need to have the higher level math, they need to have the discrete math, they need to have assembly language, so they’re more like computer science,” Buckner said. “It’s a little more elevated.”
The CAE-CO designation lasts for five academic years before the program needs to reapply to renew the designation, Buckner said.
Denno said the application process has two phases after filling out the initial application. In the first phase, the program is examined on paper by experts who review the detailed application. The second phase is an on-site evaluation where NSA experts come to the school.
“They come to your school for a day or two and they review every lecture, every lab, quizzes, they interview your professors, and they go through 10 [criteria] and only criterion number one is academic,” Denno said. The other nine criteria are based on things like outreach and research.
As for the academic portion, Denno said the NSA specifies 10 mandatory content areas and 17 optional content areas. Programs must offer 10 of those 17 areas — UA South offers 11 — and students must take four of the optional areas in addition to the 10 mandatory areas.
“What the CO program tries to do is create a graduate who had the ability to look at a network, look at a system, look at an application, find vulnerabilities in it and write exploitation code that could take that machine over because of that vulnerability, but also be able to write patch code that could close that vulnerability and secure that system,” Denno said.
Part of that ability comes from training in a virtual city called CyberApolis.
“CyberApolis is a virtual city that we built because what we teach our students in offensive cyber would be illegal for them to do on the open internet,” Denno said. “So we had to build a completely virtual city with banks and hospitals and car companies and water companies, online news media, we have our own ‘Facebook’ in there … and there’s 15,000 virtual people that are in that city that are run by a very advanced artificial intelligence we developed.”
Denno said the virtual personas have working bank accounts, working credit cards and working medical records that actually have x-rays in them, making it an extraordinarily advanced virtual cyber learning environment.
According to Buckner, they worked with a local company, Ephibian, to develop the virtual environment that has set their program apart.
While the program was already in high demand due to the amount of military bases in Arizona, Buckner said the fully online program will now be expanding even further with the aid of NSA designation and funding.
Starting this fall, the program will be offered at the University of Mauritius in Africa, at a UA micro-campus there, Buckner said.
“We’re already signed the agreement and now we’re working on the curriculum, and that’s very exciting,” Buckner said. “Mauritius is on the exact opposite side of the world from us. If you were to stick a stick right through the globe from Tucson, you would almost hit Mauritius.”
Buckner said this program is needed due to the lack of qualified workforce for national cyber security.
“There are so many jobs without people qualified to do them,” Buckner said. “We really need to start getting students to go through this and really learn how to protect our country.”
Denno said the graduates coming out of the program will certainly be able to do so.
“These graduates are capable of building cyber weapons for the nation,” Denno said. “When the NSA gets them and the government gets them they’re going to have the ability to do some of the most advanced cyber offensive operations on the planet.”
As this program results in an applied degree, not a theoretical degree, Buckner said students graduate ready to walk into an office on the first day and hit the ground running.
RELATED: UA regents professor Carol Barnes elected to prestigious National Academy of Sciences
“I really see this as a partnership with the NSA,” Bucker said. “It’s us helping them create a whole employment population for them — that’s why they’ll be funding us.”
Denno added that students will also be able to work at companies like Facebook and Visa, running sophisticated cyber defense, as they’ve been trained to find weak points.
“The students coming through the NSA engineering track, they’re truly the cyber jedi,” Denno said. “When they graduate, they are the highest skilled undergraduate cyber engineers in the nation. Hands-down, no ifs ands or buts about it. There’s no program in the nation more rigorous than the CAE-CO program.”
Follow Marissa Heffernan on Twitter
